CVE-2025-39967

What it actually does

Integer overflow in CALC_FONTSZ and FONT_EXTRA_WORDS size calculations in fbcon_do_set_font allows user-controlled values to produce undersized kernel allocations, resulting in buffer overflows on subsequent font data copies.

Why it matters to the business

Local attackers can achieve kernel-level code execution or system crashes on affected Linux systems, leading to full host compromise, data breaches, and operational disruption; high ecosystem prevalence of the kernel increases exposure across many deployments despite low EPSS.

How an attack unfolds

An attacker with local access supplies malicious font parameters to fbcon_do_set_font; the missing overflow checks in h*pitch*charcount and related additions produce a too-small allocation; the subsequent copy of attacker-controlled font data then overflows the buffer, enabling privilege escalation. Threat actors including VMSCAPE and campaigns tied to CVE-2025-39946 have targeted similar Linux kernel flaws on container-optimized OS environments.

How to fix it

Upgrade the Linux kernel to a version containing the overflow checks using check_mul_overflow and check_add_overflow; for snowflakedb/snowflake-connector-net (GIT) deployments apply the fix at commit 77bc96d51312c41f6eda64cc4e0b69072d26b7ef.

How to confirm the fix worked

Confirm the presence of check_mul_overflow and check_add_overflow guards around all font size calculations in fbcon_do_set_font; review kernel build logs or source for the resolved allocation paths; test with boundary font parameters that previously overflowed.

Typical attack path

1. Obtain local user access on a system running the vulnerable kernel
2. Invoke fbcon font-setting interfaces with crafted height, pitch, and character-count values
3. Trigger the unchecked multiplication and addition that under-allocate the font buffer
4. Perform the font data copy that overflows the undersized allocation
5. Leverage the resulting kernel memory corruption for privilege escalation or denial of service

How to detect it

Review kernel audit logs and dmesg for fbcon font-setting calls with anomalous sizes; look for allocation failures or memory corruption traces around fbcon_do_set_font; correlate with threat actor TTPs associated with VMSCAPE and CVE-2025-39946-style container escapes.

What your security team should do

• Prioritize kernel updates on all Linux hosts, especially container-optimized OS and systems with local user access, given the 377-day publication window and listed threat actor interest
• Disable unnecessary framebuffer console font changes via kernel configuration or SELinux policies where possible
• Monitor for local privilege-escalation attempts targeting fbcon and related kernel subsystems
• Apply the exact snowflakedb/snowflake-connector-net (GIT) commit 77bc96d51312c41f6eda64cc4e0b69072d26b7ef in downstream packages